PT-2019-1082 · Red Hat+1 · Ipa+2

Todd Lipcon · Published 2019-11-27 · Updated 2021-12-06 · CVE-2019-14867

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IPA versions 4.6.x before 4.6.7 IPA versions 4.7.x before 4.7.4 IPA versions 4.8.x before 4.8.3

Description A flaw was found in the way the internal function ber scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or, in some conditions, execute arbitrary code on the server hosting the IPA server.

Recommendations For IPA versions 4.6.x before 4.6.7, update to version 4.6.7 or later. For IPA versions 4.7.x before 4.7.4, update to version 4.7.4 or later. For IPA versions 4.8.x before 4.8.3, update to version 4.8.3 or later.

Fix

Code Injection

Resource Exhaustion

Weakness Enumeration

CWE-94

CWE-400

Related Identifiers

ALBA-2019:4268

ALT-PU-2019-3193

ALT-PU-2019-3206

CVE-2019-14867

GHSA-7HPJ-HFCR-5QWM

PYSEC-2019-28

PYSEC-2019-98

RHSA-2020:0378

RHSA-2020:1269

RHSA-2020_0378

Affected Products

Alt Linux

Ipa

Red Hat

References · 37

• https://access.redhat.com/errata/RHSA-2020:0378 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WLFL5XDCJ3WT6JCLCQVKHZBLHGW7PW4T · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14867 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/67SEUWJAJ5RMH5K4Q6TS2I7HIMXUGNKF · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:4268 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7hpj-hfcr-5qwm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14867 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14867 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-14867 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14867 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/67SEUWJAJ5RMH5K4Q6TS2I7HIMXUGNKF · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10195 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLFL5XDCJ3WT6JCLCQVKHZBLHGW7PW4T · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-0378.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-98 · Vendor Advisory